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Responsive to the Advisory Action mailed November 22, 2005, the following reasons are ^ 
submitted in conjunction with the pre-£^peal brief conference request. "H 

Claims 1-19 ^ 

The Examiner asserted in the Final Office Action mailed August 26, 2005 and the ^ 
Advisory Action mailed November 22, 2005 that the detection of adding, deleting, or changing ^ 
of any files as described in Kim et aL ("The Design and Implementation of Tripwire: A File ^ 

o 

System Integrity Checker" and hereinafter referred to as Kim) at page 27, paragraph 4, is Q 
analogous to "reading events representing various types of system calls" as claimed in the ^ 
present claimed subject matter. The Examiner is incorrect as stated in Applicant's October 25, 
2005 After Fmal Response (Response under Rule 116) at pages 2 and 3. Specifically, Kim 
discloses the scanning of a file system to determine v/hether any files have been added, deleted, 
or changed in comparison with a prior snapshot of the file system. 

In contrast, the present claimed subject matter relates to reading ev«its representing 
various types of system calls which is not the same as reading and comparing files in a file 
system. Files are not the same as events and Kim feils to provide any disclosure of reading 
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events, let alone events representing system calls. The instant specification at page 4, lines 7-10 
states that events pertain to system caU invocations by a process. In an embodiment, the ev^ts 
are generated by an intrusion detection subsystem connected with an operating system and 
reflect system call invocations on the operating system. For at least this reason, the rejection 
should be withdrawn. 


Further, during the course of a telephone interview held on December 22, 2005, 
Examiner Abrishamkar conceded that Kim's files are not the same as the presently claimed 
events and a new search and review should be performed. Further, in response to the Examiner's 
statement in the Advisory Action mailed November 22, 2005 that applicant's ''interpretation of 
•events' is not supported by the claim language". Applicant's attorney directed the Examiner's 
attention to the specification at page 4 for a description supporting i^plicant's arguments that the 
events include kernel records pertaining to system call invocations by a process. 

For each of the foregoing reasons, the rejection of claims 1-19 should be withdrawn, ^ 

m 
m 

To the extent necessary, a petition for an extension of time under 37 C.F.R. L136 is hereby ~J 
made. Please charge any shortage in fees due in connection with tibie filing of tihis paper, including ^ 
extension of time fees, to Deposit Account 08-2025 and please credit any excess fees to such ^ 
deposit account. - ^ 

w 

Respectfully submitted, pri 
CROSBIE, MARK et al Q 
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